Description
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpsTree Solutions | BuildPiper | < 2.7.0 | 2.7.0 |
References
- https://gist.github.com/neelkotnis/e6ba937a2ea3f06fc0a79bd6193e4574 technical-description exploit
- BuildPiper Product Page product
- VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API third-party-advisory